A gaming studio suspects EC2 cryptomining, must preserve memory, disk, and application logs for legal review, maintain chain of custody, and avoid altering the suspect host. Which forensic log capture design preserves admissible artifacts safely?
Select an answer to reveal the explanation.
Short Explanation
You’re protecting evidence without smudging fingerprints. Forensic copies in a locked bucket with memory capture, hashes, and tags preserve custody while isolation limits further damage.
Full Explanation
The design that isolates the instance, creates EBS snapshots, and captures memory to a locked forensic bucket is correct because isolation halts attacker access and lateral spread without powering off the host, external snapshots preserve disk state, and external memory acquisition preserves volatile miner processes and keys. Hashing and case tagging support integrity and chain of custody without writing to suspect volumes. Isolating the instance and copying EBS snapshots with CloudWatch logs to locked S3 preserves disk and log evidence, but omits volatile capture, permanently losing in-memory proof of mining, injected processes, and encryption keys. Quarantining the instance and saving a memory dump, snapshots, and logs to encrypted versioned S3 with access logging retains the artifact set, but versioning and access logs show durability and access, not content integrity; without cryptographic hashes and custody tags, it cannot prove tampering did not occur. Running in-guest agents to capture memory, disk, and logs provides broad collection with hashes and tags, but agents overwrite RAM, alter timestamps, and install code, violating non-alteration and inviting spoliation challenges. For exams, remember durability is not integrity, and logging is not memory capture. Practically, confirm out-of-band acquisition, record SHA-256 values, Object Lock state, and tag details at collection, then rehash from the vault to demonstrate unchanged custody.